Mohammad M Hasan

US Patent:

20190251259, Aug 15, 2019

Filed:

Feb 14, 2018

Appl. No.:

15/896980

Inventors:

- San Jose CA, US
Mohammad Masud Hasan - Laurel MD, US
Costas Kleopa - Clarksville MD, US
Shravan Rangaraju - Clarksville MD, US

International Classification:

G06F 21/56
G06F 21/55
H04L 29/06

Abstract:

In one embodiment, a computing device collects ransomware behavioral data of known ransomware, the ransomware behavioral data based on one or more file writing features, and trains a ransomware classifier with the ransomware behavioral data to detect ransomware. The computing device may then share the ransomware classifier with a detection device to cause the detection device to behaviorally detect ransomware based on applying the ransomware classifier to monitored file writing activities. In another embodiment, in response to behaviorally detecting ransomware, based on applying the ransomware classifier to monitored file writing activities, the detection device may then perform one or more ransomware mitigation measures in response to behaviorally detecting ransomware.